From Risks to Resilience: Leveraging CNCF Projects Against Kube...
summary
Maps each OWASP Kubernetes Top 10 risk to specific CNCF tools and shows a decision path applied to a small AI startup that picks options to minimize learning while covering predeploy and runtime controls. Recommends Kyverno + Falco for policy and runtime detection, Harbor + in-toto/TUF for image integrity, Keycloak for identity, Argo CD for GitOps, OpenTelemetry for telemetry, Cilium for network segmentation and SPIRE for workload identity. Cites a Red Hat survey where 60% report misconfiguration incidents in the past 12 months.
AI-written summary · about
chapters (13)
- 0:00CNCF and OWASP Kubernetes challenges
- 2:08Security decision making role play
- 5:00Insecure workload configurations
- 11:24AI startup supply chain risks
- 16:02Excessive permissions challenges
- 18:36GitOps for security compliance
- 21:48Logging monitoring observability
- 25:41Broken authentication cleanup
- 27:30Network segmentation CNI selection
- 29:58Secrets management workload identity
- 32:10Cluster hardening misconfigurations
- 33:38Open source project risks
- 35:26Q&A Spiffe SPIRE tradeoffs
related talks
51mIntroducing the OWASP Top 10 for Kubernetes
22mSecuring Kubernetes
27mSurviving Day2 : Picking the Right Tool To Secure Your Kubernetes Habitat
22mIntroducing the OWASP Top Ten for Kubernetes
32mOWASP Kubernetes in-depth - Nigel Douglas
26mKubernetes Risk Assessment: Time to Go One Level Deeper
19mKubernetes Security: Navigating the Real-World Challenges
06mKeynote: Future-Proofing Kubernetes